Skip to content
Help Center
withpersona.comDashboard

SAML-based single sign-on (SSO) with Okta for Persona Dashboard

View Markdown Contact support Contact support 6 min read
On this page

Overview

Use this guide to enable SAML-based Single Sign-On (including Just-In-Time (JIT) provisioning with SAML) for the Persona Dashboard through Okta.

By default, users can log in through SAML or with email and password. To configure SAML enforcement, a user with Admin permissions goes to Organization > Authentication.

Retrieve your Organization Slug

Log in to your Persona dashboard as a user with Admin permissions.

  1. Go to Organization > General.
  2. Next to Organization slug, copy your Organization Slug.

Write down your Organization Slug. You need it in the next steps. After you enable SSO, the slug also shows under Single sign-on on the Authentication tab.

Add Persona to Okta

  1. Log in to your Okta organization as a user with administrative privileges. Make sure that you change to the Admin Console with Classic UI. At this time, the new UI does not support SAML based integrations.

  2. Click Applications in the menu bar. Then click Add Application and then Create New App.

  3. In the Create a New Application Integration dialog box, keep Web as the platform and select SAML 2.0 as the protocol. Click Create.

  4. On (1) General Settings, enter Persona as the name of the new Application. Click Next.

  5. On (2) Configure SAML, enter these values in the fields:

    General

    • Single sign on URL: https://withpersona.com/saml/<ORGANIZATION-SLUG>/acs
    • Audience URI: https://withpersona.com/saml/<ORGANIZATION-SLUG>/metadata
    • Name ID Format: Unspecified
    • Application username: Email

    ORGANIZATION-SLUG comes from the first section (Retrieving your Organization Slug)

    Attribute Statements

    NameName formatValue
    user_emailUnspecifieduser.email
    name_firstUnspecifieduser.firstName
    name_lastUnspecifieduser.lastName

  6. Click Next. Then give feedback if you want to.

  7. Get your Identity Provider metadata URL. Persona uses it to integrate with Okta. To find it, go to the Sign On tab and click the Identity Provider metadata link in the SAML 2.0 callout. Copy the URL and keep it for the next steps. The format of the URL is https://dev-12345.okta.com/app/abcdefg/sso/saml/metadata

Complete the Okta integration in Persona

  1. Log in to your Persona dashboard as a user with Admin permissions.
  2. Go to Organization > Authentication.
  3. Under Single sign-on, click Set up (or Manage if SSO is already configured).
  4. Enter the Metadata URL that you got in the last step of the Adding Persona to Okta section.
  5. Click Register provider (or Update provider if you are changing an existing configuration).

Set up SSO with the metadata URL, not with a static metadata XML file. Persona reads the URL again. When you activate a new SAML signing certificate in Okta, Persona gets it automatically. Your SSO continues to work, and you do not have to change Persona.

If the setup is successful, a notification tells you that your Okta integration is set up.

Logging in to Persona through Okta

  1. To log in to Persona through Okta, first make sure that the user is assigned to the Application in Okta.
  2. The user should then see Persona in their Okta dashboard. When they click Persona, they should automatically log in to their Persona dashboard.

Renewing an expiring SAML SSO certificate

SAML signing certificates expire. Persona monitors the expiration date of your certificate and reminds you before it expires. But you must generate and activate the replacement certificate in Okta and make it available to Persona.

If Persona already has your live Identity Provider metadata URL, we automatically get the renewed certificate after you activate it in Okta. You do not have to do more on the Persona side. If you set up your integration with a static metadata XML file, you must upload the updated metadata again each time the certificate rotates. To prevent this, change it to the metadata URL.

You do not have to create a new Okta application. Use the existing application that you set up for Persona login. A new application is the most frequent cause of broken SSO.

Generate a new certificate in Okta

  1. Log in to your Okta organization as a user with administrative privileges. Switch to the Admin Console with Classic UI.

  2. Go to Applications and open the existing application you use for Persona login.

  3. Click the Sign On tab.

    Generate a new certificate in Okta

  4. Scroll to the SAML Signing Certificates section and click Edit.

  5. Click Generate New Certificate. A new certificate row appears with a status of Inactive.

Activate the new certificate

Keep your current certificate Active until the new one is activated and works. Keep a copy of your existing metadata XML, so that you can go back to it if logins stop working.

  1. In the SAML Signing Certificates table, find the row of the new (Inactive) certificate.

    Activate Certificate in Okta SSO

  2. In the Actions column, click Activate. Its status changes to Active and the previous certificate becomes Inactive.

    Activate Action for Certificate in Okta SAML SSO

Refresh the metadata in Persona

If Persona already has your live Identity Provider metadata URL, Persona gets the renewed certificate automatically. You can then skip these steps. If your integration still uses a static metadata file, change it to the URL now. Then you do not have to do anything for future rotations:

  1. In Okta, copy your Identity Provider metadata URL from the Sign On tab (format: https://dev-12345.okta.com/app/abcdefg/sso/saml/metadata).
  2. Log in to your Persona dashboard as a user with Admin permissions.
  3. Go to Organization > Authentication.
  4. Under Single sign-on, click Manage (or Set up).
  5. Enter the metadata URL and click Update provider (or Register provider).

FAQs

Does Persona support JIT provisioning via SAML?

Yes. We support JIT provisioning for users.

Is there an API for creating and disabling users?

At this time, we do not have an API to create or disable users.

Is it possible to send over the user’s role in Persona as an attribute in the SAML assertion?

At this time, all new users get the default role of the Organization. You configure this role in the dashboard. At this time, we do not support a user role as an attribute. If this is a high priority for your team, contact your Persona contact or Persona support to tell us about your need.

Plans Explained

SAML-based SSO with Okta by plan

Startup ProgramEssential PlanGrowth PlanEnterprise Plan
SAML-based SSO with OktaAvailableAvailableAvailableAvailable
SCIM with OktaNot AvailableNot AvailableNot AvailableAvailable

Learn more about pricing and plans.

Was this page helpful?If something is missing, let us know and we will take a look.
Thanks for the feedback. It helps us improve these docs.

Related articles

SAML-based single sign-on (SSO) with Google for Persona Dashboard
Admin · Single sign-on (SSO) and Authentication
SAML-based single sign-on (SSO) with Azure for Persona Dashboard
Admin · Single sign-on (SSO) and Authentication
Setting up Okta SCIM
Admin · Single sign-on (SSO) and Authentication
Setting up Microsoft Entra SCIM
Admin · Single sign-on (SSO) and Authentication